{"id":103374,"date":"2022-02-18T03:37:22","date_gmt":"2022-02-18T01:37:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-02-18T03:37:22","modified_gmt":"2022-02-18T01:37:22","slug":"lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Vulnerabilit\u0103\u021bi root locale \u00een instrumentele de gestionare a pachetelor Snap","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Qualys a descoperit dou\u0103 vulnerabilit\u0103\u021bi (CVE-2021-44731, CVE-2021-44730) \u00een utilitarul snap-confine, livrat cu flag-ul SUID root \u0219i invocat de procesul snapd pentru a forma un mediu de execu\u021bie pentru aplica\u021biile livrate \u00een pachete autonome \u00een format snap. Vulnerabilit\u0103\u021bile permit unui utilizator neprivilegiat local s\u0103 execute cod cu drepturi de root \u00een sistem. Problemele au fost remediate \u00een actualizarea de ast\u0103zi a pachetelor snapd pentru Ubuntu 21.10, 20.04 \u0219i 18.04. <\/p>\n

Prima vulnerabilitate (CVE-2021-44730) permite realizarea unui atac prin manipularea link-urilor dure, dar necesit\u0103 dezactivarea protec\u021biei sistemului pentru link-urile dure (setarea sysctl fs.protected_hardlinks la 0). Problema este cauzat\u0103 de verificarea incorect\u0103 a loca\u021biei fi\u0219ierelor executabile ale utilitarilor snap-update-ns \u0219i snap-discard-ns, care sunt rulate cu drepturi de root. Calea c\u0103tre aceste fi\u0219iere era calculat\u0103 \u00een func\u021bia sc_open_snapd_tool() pe baza propriei c\u0103i din \/proc\/self\/exe, ceea ce permite crearea unui link dur c\u0103tre snap-confine \u00een propriul director \u0219i plasarea \u00een acest director a variantelor de utilitare snap-update-ns \u0219i snap-discard-ns. Dup\u0103 rularea prin link-ul dur, snap-confine cu drepturi de root va lansa din directorul curent fi\u0219ierele snap-update-ns \u0219i snap-discard-ns furnizate de atacator. <\/p>\n

A doua vulnerabilitate este cauzat\u0103 de o condi\u021bie de competi\u021bie \u0219i poate fi exploatat\u0103 \u00een configura\u021bia implicit\u0103 Ubuntu Desktop. Pentru ca exploit-ul s\u0103 func\u021bioneze cu succes \u00een Ubuntu Server, este necesar s\u0103 se aleag\u0103 unul dintre pachetele din sec\u021biunea «Featured Server Snaps» \u00een timpul instal\u0103rii. Condi\u021bia de competi\u021bie se manifest\u0103 \u00een func\u021bia setup_private_mount(), care este apelat\u0103 \u00een timpul preg\u0103tirii spa\u021biului de nume pentru punctele de montare ale pachetului snap. Aceast\u0103 func\u021bie creeaz\u0103 un catalog temporar «\\\/tmp\\\/snap.$SNAP_NAME\\\/tmp» sau folose\u0219te unul existent pentru a realiza un mount de tip bind \u00een el pentru directoarele pachetului \u00een format snap. <\/p>\n

Deoarece numele catalogului temporar este previzibil, un atacator poate \u00eenlocui con\u021binutul s\u0103u cu un link simbolic dup\u0103 verificarea proprietarului, dar \u00eenainte de a apela la apelul de sistem mount. De exemplu, se poate crea \u00een directorul \\\/tmp\\\/snap.lxd un link simbolic «\\\/tmp\\\/snap.lxd\\\/tmp» care s\u0103 indice c\u0103tre un catalog arbitrar, iar apelul mount() va urma linkul simbolic \u0219i va monta catalogul \u00een spa\u021biul de nume al snap-ului. \u00cen mod similar, se poate monta propriul con\u021binut \u00een \\\/var\\\/lib \u0219i, prin \u00eenlocuirea \\\/var\\\/lib\\\/snapd\\\/mount\\\/snap.snap-store.user-fstab, se poate organiza montarea propriului catalog \\\/etc \u00een spa\u021biul de nume al pachetului snap pentru a permite \u00eenc\u0103rcarea bibliotecii sale cu drepturi root prin \u00eenlocuirea \\\/etc\\\/ld.so.preload. <\/p>\n

Se observ\u0103 c\u0103 crearea unui exploit s-a dovedit a fi o sarcin\u0103 neobi\u0219nuit\u0103, deoarece utilitarul snap-confine este scris \u00een limbajul Go folosind tehnici de programare sigur\u0103, are protec\u021bie bazat\u0103 pe profiluri AppArmor, filtreaz\u0103 apelurile sistemului pe baza mecanismului seccomp \u0219i aplic\u0103 pentru izolare un spa\u021biu de nume pentru montare. Cu toate acestea, cercet\u0103torilor le-a reu\u0219it s\u0103 preg\u0103teasc\u0103 un exploit func\u021bional pentru ob\u021binerea privilegiilor de root \u00een sistem. Codul exploit-ului va fi publicat \u00een c\u00e2teva s\u0103pt\u0103m\u00e2ni, dup\u0103 ce utilizatorii vor aplica actualiz\u0103rile furnizate.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-44731, CVE-2021-44730) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 snap. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 snapd \u0434\u043b\u044f Ubuntu 21.10, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103374","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi locale de tip root \u00een instrumentele de gestionare a pachetelor Snap | ProHoster","description":"Compania Qualys a descoperit dou\u0103 vulnerabilit\u0103\u021bi (CVE-2021-44731, CVE-2021-44730) \u00een utilitarul snap-confine, livrat cu flag-ul SUID root \u0219i apelat de procesul snapd pentru a forma mediul de execu\u021bie pentru aplica\u021bii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 root-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 Snap | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-44731, CVE-2021-44730) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/lokalnye-root-uyazvimosti-v-instrumentarii-upravleniya-paketami-snap","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-18T01:37:22+00:00","article:modified_time":"2022-02-18T01:37:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103374","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-18 01:37:39","updated":"2022-10-10 21:24:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103374"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103374\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}